Good cloud migration security means deciding who is responsible for what before moving anything, then configuring identity, external interfaces, logging and recovery as part of the move, not after it. The UK NCSC's 14 cloud security principles give a ready checklist for judging both the provider and your own setup.
What changes when you move?
You hand some controls to the provider and keep others. CISA's Cloud Security Technical Reference Architecture covers the shared risk model, how to build a cloud environment and how to monitor it. The NCSC's principles make the same split from the buyer's side: they "are designed to help you choose a cloud provider that meets your security needs", and you "will separately need to consider how you configure your cloud services securely".
Two separate questions follow. Is the provider good enough? And are we using it safely? Most migration incidents come from the second one.
Which principles matter most to a migration team?
The NCSC lists fourteen. Several map directly onto migration tasks.
Identity and authentication (10) says all access to service interfaces should be constrained to a securely authenticated and authorized identity, human or machine. Plan this before the first workload moves: single sign on, multifactor authentication, and a rule that machines use scoped credentials.
Secure user management (9) is about role based access controls across the service and the data in it. Decide roles up front, or the first people to arrive will become administrators permanently.
External interface protection (11) says external or less trusted interfaces, including APIs, web consoles and command line interfaces, should be identified and defended. A migration often exposes new endpoints. List them.
Audit information and alerting (13) says you should be able to find out how and when incidents occurred. Turn on and retain the logs on day one, since you cannot reconstruct what was never recorded.
Data in transit protection (1) and asset protection and resilience (2) cover encryption and recovery. Test the restore, not only the backup.
Supply chain security (8) says the provider's supply chain should meet your standards, including third parties with access to your data. Ask who those third parties are.
Secure use of the service (14) says the provider should make it easy to meet your data protection responsibilities, and where defaults are weak, help you. Read the provider's security guidance for each service you adopt.
What are common migration mistakes?
Lifting an old network design into the cloud unchanged, with flat networks and shared administrator accounts. Leaving migration test environments running with real data. Copying secrets into scripts to hurry a cutover. Declaring success when the application works, not when the logging and backup work.
A constructed example
A company migrates a customer portal. The plan includes a day zero checklist: identity provider connected, multifactor authentication required for every console account, storage buckets private by default, audit logs sent to a separate account with restricted access, and one restore test before cutover. During testing the team finds the portal's admin API reachable from the public internet through a leftover test rule. They close it before launch.
How to check or apply this
- Write a responsibility table: for each service, who patches, configures, monitors and recovers.
- Walk the NCSC principles for the provider and note the evidence you have.
- Set up identity, roles and logging before moving data.
- List every externally reachable interface, and justify each one.
- Test a restore and an incident drill before cutover.
- After cutover, delete migration scaffolding, temporary credentials and test data.
Safeguard's compliance automation tests cloud accounts against framework controls, and dependency scanning covers the applications you move.
Quick check
Who is responsible for security after migration?
Both parties, in different areas. The provider secures the service. You configure it, manage access, and protect your data in it.
What should be in place before data moves?
Identity and multifactor authentication, roles, private by default storage, logging with retention, and a tested restore.
Sources
Last reviewed: 18 October 2026.
